Personal Health Record Use by Adolescents

In response to many questions about PHR use by adolescents, I asked Fabienne Bourgeois, the expert at Children's Hospital Boston, to write this guest blog post -

As more and more practices and hospitals are making patient portals available to their patients, providers of adolescent patients are encountering a major hurdle: how to handle confidential adolescent information.

While adult patients generally maintain full personal control of their personal health record (PHR), adolescent PHRs are anything but personal.  Adolescents rarely have full control of their record, but instead rely on parents and guardians to share control.  The details around this shared access changes over time, depending on developmental and age-appropriate considerations, as well as guardianship arrangements.  

The biggest challenge then, becomes how to protect the adolescent’s legal right to privacy and confidentiality within this hyprid/proxy-control model.  Many medical encounters with adolescents come with the verbal assurance that what they tell us will (under most circumstances) remain entirely confidential, meaning we will not discuss personal health information pertaining to reproductive health, sexually transmitted diseases, substance abuse and mental health with their parents or anyone else without their consent.   As it turns out, this type of confidential information is pervasive through most EHRs.

We've spent a lot of time thinking about this issue and adolescent access to our patient portal, and ultimately developed a custom built solution to meet our and our patients’ needs.

Our approach is built around differential access to the patient portal with the goal of mirroring current clinical practice and works as follows:

Access to the patient portal: Separate accounts are created for the patient and parent(s) that are linked. The parent has sole access to the patient's portal until the patient turns 13, at which point both the parent and the patient can have access.  We chose 13 years as our cut off based on a number of factors, including developmental maturity and other precedents at our institution based on their policies.  At 18 years, the patient becomes the sole owner of the portal account, and we deactivate the parent's link (unless we receive court documents stating that the parent remains the medical guardian).

Health information contained in the patient portal: We have identified and tagged certain information from our EHR that we consider sensitive, such as labs related to pregnancy, sexually transmitted illnesses, genetic results, select confidential appointments, and potentially sensitive problems and medications. This information is currently filtered from both parent and adolescent accounts, but in the near future the sensitive information will flow to the adolescent account, but not to the parent account. So, even if a patient is less than 13 years, the parent would not have access to this information.
This solution does take a lot of time and effort, but best replicates the current clinical practice. Many other current PHR structures do not allow for this type of differential access and only enable full proxy access.

Alternative solutions include the following:
1.    Shared access for patient and parent, but filtering of sensitive information. One could then choose the age at which patients would gain access without worrying about the parent seeing sensitive information at any age. This makes the age at which the patient obtains access, whether it is 10 or 13 years, less important. Unfortunately, this option restricts adolescent access to confidential information and creates a fragmented and incomplete record.

2.       Adolescent access only. This is trickier, because choosing the appropriate age when parental access is discontinued is difficult and may vary depending on patient characteristics.  Many practices choose 12 or 13 years. However, if sensitive information is not being filtered, you may very well have the occasional 11 year old with an STI. Also, some parents object to being cut off from their child's medical information and many play an important role in supporting their adolescent children and guiding them through healthcare decisions.

The issues and solutions involved with adolescent PHRs are certainly complex and will continue to evolve over time. However, I am hopeful that PHRs will start incorporating the unique needs of the adolescent population in the near future, allowing both parents and adolescents to share responsibility and engage in their healthcare.

For additional information, see this publication

Bourgeois FC,  Taylor PL, Emans  SJ, Nigrin DJ, Mandl KD. Whose personal control? Creating Private, Personally Controlled Health Records for Pediatric and Adolescent Patients  J. Am. Med. Inform. Assoc. 2008;15(6):737-743

Building a Trust Fabric in Massachusetts

Yesterday, several Massachusetts HIE stakeholders discussed how best to create a trust fabric among the array of vendors, organizations, and regional subnetworks that will exchange transfer of care summaries using the Meaningful Use Stage 2 standards.    Here's the presentation we used to facilitate our discussion.

Initially our state HIE, the MassHIWay, presumed it would be the certificate authority/registration authority for all state stakeholders, creating a trust fabric through a single set of processes and agreements.    As often occurs in life, theory and the practice differ.  

eClinicalWorks users are likely to use the eCW HISP to send and receive transactions from/to their EHRs, using SMTP/SMIME to connect to users of the MassHIWay.

Cerner users are likely to use Cerner's HISP are in the same way.

Epic users may use Surescripts' HISP similarly.

Meditech users will connect directly to the state's HISP via SOAP (XDR).

How do we knit together all of the HISPs into a trust fabric that authenticates our users, authorizes access for appropriate clinicians, and minimizes privacy risks?

It's clear that we must embrace technology and policies which enable HISP to HISP communications, not just a single HISP and certificate authority.

From a technology perspective there are a few options:
 - Use DirectTrust.org certificate bundles backed by processes that enable organizations to trust a common entity and thus transitively trust each other.
 - Create a Massachusetts specific process to trust the root certificates of each HISP that connects to the MassHIWay
 - Ask each provider in the state to sign a MassHIWay participant agreement regardless of the HISP they use, ensuring common policy and legal protections are in place.

We did not answer all these questions yesterday and we've assigned workgroups to finalize the policy and technology details.  We did accept the fact that there will be several HISPs connecting providers, payers, and patients in Massachusetts.  We'll need to trust other HISPs that have registration and certificate authority processes in place to identity proof/authenticate their senders and receivers.   The reality of Meaningful Use Stage 2 certified software is that sometimes the connections will be with the EHR directly, sometimes through the EHR vendor's cloud, and sometimes through third parties.  

Just as the internet itself is ultimately a network of networks, so will be healthcare information exchange in Massachusetts, the US, and the world.

2013 is the year we'll address the policy and technology barriers that have historically slowed adoption of large scale HIE.

Building Unity Farm - Shearing the Alpaca

Last weekend we sheared the alpacas and llama.  As Unity Farm works to become a self sustaining agricultural entity,   we plan to sell natural colored alpaca yarn and hand made raw fiber cat toys this Summer.

Above, you'll find the before and after photos.    Our enormous and fluffy animals now look like creatures from a Dr. Seuss book.

Here's how the day went.

We sheared from 12:30pm-9:30pm, with a few small breaks.  We spent about an hour per animal to gently cut each animal's fiber into a single large "blanket".  We also trimmed nails and did a thorough job cleaning and trimming the teeth.

We used a commercial blow dryer to clean their fiber before trimming, once for each side of the animal.

The animals were handled respectfully and were very cooperative (they look completely content in the paddocks this morning)

This was our first shearing experience, so there were many lessons learned that will make next year faster and easier.   My blog will never be a commercial site, but later this year I will post links to the Unity Farm products that we'll be offering - berries, apples/cider, shitake mushrooms, oyster mushrooms, alpaca yarn, eggs, and honey.

The May Massachusetts HIT Council Meeting

Just as the national HIT Standards Committee meets every month and I record its deliberations on my blog, the Massachusetts HIT Council, a governance body for healthcare IT activities in the Commonwealth, meets monthly.   The Council is a multi-stakeholder body including public and private sector participants from every aspects of the healthcare system.

We met on Monday to review progress on State HIE implementation.   Here are the presentation materials.

In May, Tufts Medical Center will go live with transfer of care summaries sent to payers in support of disease management programs.

BIDMC will go live with immunization and reportable lab submissions to the Department of Public Health.   Also in May, BIDMC will go live with sending 4000 care summaries each day to our quality registry provider, the Massachusetts eHealth collaborative.

Holyoke Medical Center will go live with transfer of care summary transmission to its community providers in May.

27 implementation grants to stakeholders through the commonwealth have been awarded to accelerate connectivity to the state HIE backbone.

Meaningful Use Stage 2 and ACO formation have created a business case for data sharing and we'll see accelerating adoption over the next few months.

Lastly, Medicaid approved the funding for the second phase of the HIE - the community wide master patient index, record locator service and consent registry.   We'll have these built by the end of 2013.

It's an exciting time in Massachusetts - HIE has finally achieved the level of policy and technology maturity we've been anticipating for the past decade.

A Bold New Vision for Meditech

I have no financial relationships with any EHR vendor, but feel a great affinity for the vendors in Massachusetts - eClinicalWorks, AthenaHealth and Meditech.

For the past few years, I've suggested to Meditech that cloud hosted, standards-based, web-centric and mobile enabled hospital information systems would be very welcome by the marketplace.

The industry has had a mixed reaction to Meditech version 6, a proprietary, non-standard, non-web, non-cloud, non-mobile, client/server application that requires complete hardware and software replacement when upgrading from version 5.

I spent last Monday afternoon at Meditech and can tell you that they have listened to industry feedback (and my obsessive focus on web-based applications).

The  Meditech senior team demonstrated version 6.1, a cloud hosted, standards-based, web-centric, mobile enabled, ambulatory and inpatient, analytics backed, personal health record enabled, and care managed focused application that will be shipping in 2014.

What did I see?

A new ambulatory EHR written from scratch to work on iPads supporting a voice-based or typed workflow.   Some vendors have created two applications often with different copies of the data- one for the desktop and one for mobile devices.  Meditech has wisely optimized the 6.1 EHR application for multiple devices using the same architecture from the same database.   LSS, the previous ambulatory application, will be replaced by the new application that includes very friendly medication management, clinical documentation, and order entry tools.

A new Meaningful Use Stage 2 compliant Hospital Information System that is available anywhere without Meditech specific client software.   The Direct protocol for interoperability is fully enabled.

A new PHR written from scratch designed for mobile devices and including many advanced wellness/preventative care features.

A new analytics platform that includes self service data mining tools

A new "post EHR" application that synthesizes the lifetime experience of the patient and enables non-physician care managers to ensure patients are receiving  optimized care per protocols.

Everything was demonstrated via an iPad.

They are also working on applications to support anesthesia, ICUs, and infection surveillance.  My only advice to them was to create  a few full featured, highly usable products rather than try to launch an entire suite of products simultaneously that lack comprehensive functionality.   The 6.0 product was a complete re-platforming for Meditech which resulted in some upgraded products not having all the features of their 5.x predecessors.

In the past two years, Epic has gained a very large share of the hospital IT marketplace.    Since competition is a good thing for the industry, I'm hopeful that Meditech 6.1 will be very attractive to hospitals which want to implement a modern platform at an attractive price.

Meditech's new vision is bold and in my opinion, right on track.

I'm eagerly awaiting the production delivery of 6.1.

Building Unity Farm - The Orchard is Born

When Kathy and I began looking at farmland, we developed a set of requirements (and a project plan) for selection of a property that would nurture us into retirement and beyond.

After reading many books about sustainability and farming, we decided that 15 acres was more in line with our goals than 150 or 1500.   Our plan was to work the land on our own, not involve a staff of farm hands.  

We wanted a diverse ecosystem and not just a flat empty fields.   The ideal property would include pasture for animals, woodland for fuel, marsh/stream/vernal ponds for wildlife habitat, wildflowers/grasses for pollinators, and space for an orchard/hoop house/berry patch.

As of today, Unity Farm has come very close to that goal.

We now have 15 acres divided into
 5 acres of dry woodland (oak, maple, ash, hickory, cedar, poplar, elm, pine)
 2 acres of orchard/hoop house/berry patch
 2 acres of marsh/stream/vernal ponds
 1 acre for house, shed, roads, and lawn
 1 acre of pasture (orchard grass/timothy hay)
 1 acre of meadow (wildflowers/grasses)
 2 acres of barnyard (barn, paddocks, poultry coop)
 1 acre of work areas for wood processing, composting, and mushroom farming

The orchard, pictured above, now contains 30 fruit/nut trees, 180 blueberry bushes, 30 raspberry bushes, and a foundation for the 21' x 50' foot hoop house we'll build later this Summer, all surrounded by an 8 foot deer fence.

In the past, I was a rock climber, an ice climber, and an alpinist.   Creating the orchard involved many weekends with a chainsaw, a pushcart for wood hauling, and a wheelbarrow.   I've burned more calories and gained more upper body strength as a farmer than I ever had as a mountaineer.

Thanks to my wife Kathy for her vision, Stumpy's for tree clearing, Tree Specialists/Barbara Keene-Briggs for tree species selection and design, Paul Rossi for excavating/grading artistry, and River Valley Fencing for protecting all the produce from being eaten.

In three years we'll harvest our first fruit crops.  Now that the orchard is done, our next task is to shear the alpaca and complete the mushroom inoculation so that we'll have our first crops of Shitake and Oyster mushrooms by next Spring.

The Toad and the Snake

Over the weekend while working in the orchard, I found a small garter snake trying to eat an enormous toad, pictured above.

Did the toad not realize that by wriggling its feet, it could easily escape?   Was the toad unaware of the impending threat?  Might the toad have given up and thought that the end was inevitable?

Did the snake not realize that the toad was much larger than it could possibly digest?  Garter snakes have special jaw hinges that allow them to swallow things wider than their bodies.  Was the snake so optimistic about the benefits of an enormous meal that it was willing to discount the risks it faced in the swallowing process?  Might the garter snake have seized the opportunity because the conditions were right for eating the toad slowly over time?

As if often the case, I tried to find deeper meaning in this encounter with survival of the fittest.   On a daily basis, I examine my life, asking who I am, where I've been, and where I'm going.

In my early years as CIO, I did not know the risks I faced, what I had to lose, and who I might upset along the way.    I was the garter snake.   Out of this period came new advances in interoperability, patient portals, and clinical applications.    Everything was developed in a disruptive rapid cycle improvement fashion.

Today, might I have become the toad?

Have I become too risk adverse in a world of enhanced regulatory enforcement?  Have I evolved from the innovative rogue to the keeper of the status quo?  Have I become too attached to the customer relationships I've formed, the incumbent vendors I've chosen, and the strategy I have shepherded for 15 years?

In analyzing my behavior, I do not believe I've become the toad quite yet, but am I very sensitive to the warning signs.

In 1996, when I was faced with impossible tasks for which there was no technology, no standards, and no policy, the answer was simple - create them and if they failed, try again.

In 2013, with auditors reviewing my every project, government agencies scrutinizing my process maturity, and boards wanting to minimize risk, how can we reduce the barriers to innovation?

I do not have a complete answer, but I have an idea.

I would like to begin raising funds from inspired philanthropists, grateful BIDMC patients, and partner companies to create what I'll metaphorically call the New Organization for Transformative Outside-the-box Application Development  (NO TOAD)

Of course we'll continue innovating in all my operational BIDMC IT groups, but somehow NO TOAD has to be constructed and chartered to do work unconstrained by convention, risk adversity, or anxiety about the things that create overhead in 2013 and did not exist in 1996 such as

Project management offices
Application development methodology
Communication and milestone reporting
Operational oversight during workflow design and development
Business readiness
Policies, procedures and guidelines documentation
Training and education plans
Cutover planning
Functional/performance testing approach
End-to-end and user acceptance testing
System support plans
Infrastructure and controls
General and organizational controls
Physical and logical controls
Program change controls
Disaster recovery and business continuity plans

Is this possible?   I think so.

We'd create a large de-identified data set that could be openly used by developers without fear of violating HIPAA.

We'd isolate devices from the hospital network to enable freedom and experimentation with technology not allowed in a high security production environment.

Prototyped code would be reimplemented into production software using formal approaches only after it had proven its value.

By design (a separate LLC?) NO TOAD would be considered outside the scope of healthcare audit and regulatory burdens.

Projects would be audacious, aggressive, and agile.   Many would be expected to fail.   The culture would be high risk, high reward without concern for the limitations of current healthcare policies or technologies.

Lessons from Bell Labs, Steve Jobs' reality distortion field, and Google's 20% freethinking policy would guide the selection of ideas to pursue.

Over the past few months I've joined a number of BIDMC philanthropy activities, building awareness of the unique culture that is BIDMC and the amazing talented people that work there.

My challenge is now to incubate a true learning laboratory for BIDMC that can enable garter snakes who are not intimidated by the impossible tasks ahead.  Think of it as healthcare IT unchained.

If it works, I'll happily tell people that the entire idea was inspired by a concern that we've become prisoners of risk avoidance and a toad that decided the status quo was unchangeable.

NO TOAD.  An idea whose time has come.

And so the fundraising begins.